From 10df2f67cff0cbe9d72b011ae08e5e5472108f34 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Thu, 13 Jul 2017 00:17:20 -0400 Subject: [PATCH] --- doc/kerberized-server.mdwn | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/kerberized-server.mdwn b/doc/kerberized-server.mdwn index a87d552..0231907 100644 --- a/doc/kerberized-server.mdwn +++ b/doc/kerberized-server.mdwn @@ -41,7 +41,7 @@ later add get this file by default.) ## Upgrading cryptographic strength -You may wish to change the encryption algorithms (*enctypes*) included in your keytab. With server principals (like `daemon/servername.mit.edu` or `host/servername.mit.edu`) it is particularly important to support *only* strong algorithms. If you support a weak algorithm, an attacker can request a service ticket encrypted with that key, allowing them to do an offline attack and potentially extract your secret key. +You may wish to change the encryption algorithms (*enctypes*) included in your keytab. With server principals (like `daemon/servername.mit.edu` or `host/servername.mit.edu`) it is particularly important to support *only* strong algorithms. If you support a weak algorithm, an attacker can request an initial ticket encrypted with that key, allowing them to do an offline attack and potentially extract the secret key. To change the supported enctypes, run `kadmin`: -- 2.44.0